Exploring Malicious Lambda Layers
summary
Demonstrates concrete vulnerabilities that let a layer perform a man-in-the-middle on Lambda I/O by hijacking AWS_LAMBDA_RUNTIME_API, and a deeper memory scan-and-patch via Firecracker’s rapid process to overwrite environment variables and secrets ports. Provides a working PoC that patches seven memory regions in ~0.25s and returns “I am evil,” built from an internal wrapper plus an external extension and exploiting layer merge-order collisions; effective but requires layer installation or privileged merge positioning.
AI-written summary · about
chapters (10)
- 0:00Malicious Lambda layers intro
- 3:54Lambda extensions and limits
- 7:22Breaking Lambda runtime
- 12:18Man-in-the-middle PoC
- 15:49Firecracker memory access exploit
- 17:39Live memory patching demo
- 19:01AWS Secrets Manager compromise
- 20:45Layer merging and file collisions
- 22:50Mitigation strategies
- 24:34Resources and closing
related talks
36mGone in 60 milliseconds: Offensive security in the serverless age
30mServerless Infections - Malware Just Found a New Home
34mServerless Infections: Malware Just Found a New Home
27mSecuring The Gateway And Mitigating Risks In LLM API Integration
46mAttacking AWS: The Full Cyber Kill Chain
53mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
49mBreaching LLM-Powered Applications: Overcoming Security and Privacy Challenges
48mAlexa, Hack My Server(less) Please